Getting Data In

Data Base Retention Adjustment

New Member

Hi All

I want to set my Splunk server to keep logs active for 30 days then compress those logs, save it in another directory active for 90 days.

what i know after some searches that all that configuration can be done from indexex.conf file but i didn't understand what is hot, cold & frozen, what is maxhotIdlesecs??

little help will be appreciated.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!